Cleared For Discussion

Episode 43 Summary – Gold Bars and Ghost Degrees

In this episode, Tabetha Baume examines the case of former CIA official David Rush, who allegedly used falsified credentials and abused his position of trust to steal millions of dollars in government assets, highlighting how insider threats extend far beyond traditional espionage.

She explains how failures in credential verification, continuous vetting, and organizational oversight allowed warning signs to go undetected for years, while emphasizing the importance of recognizing fraud, theft, and unexplained affluence as insider threat indicators.

Her key message is that organizations must strengthen vetting, reporting, and insider threat programs, while ensuring trained personnel remain vigilant for behavioral and financial warning signs that technology alone may not detect.

Episode 42 Summary – Foreign Influence in American Contracting

In this episode, Tabetha Baume explains how foreign-owned entities can access unclassified government contracts with limited ownership scrutiny, exposing major gaps in current contracting systems.

She highlights weaknesses in SAM.gov registration, recent fraud cases involving foreign-controlled companies, and the Department of Defense’s proposed DFARS rule aimed at expanding foreign ownership disclosures.

Her key message is that contractors must better vet ownership structures, teaming partners, and supply chains as the government increases focus on foreign influence and contracting transparency.

Episode 41 Summary – Cloud Computing & Classified Info

In this episode, Tabetha Baume explains the risks and compliance challenges of handling classified information in cloud environments, highlighting frameworks like NISPOM, FedRAMP, and CMMC.

She uses the Microsoft Storm-0558 breach to show how cloud misconfigurations and poor coordination between IT and security teams can expose sensitive government data. She also warns about growing risks from generative AI and shadow IT tools.

Her key message is that strong cloud security requires close collaboration between FSOs and IT teams, continuous monitoring, and proactive security practices to protect sensitive information.

Episode 40 Summary – CFD Podcast: Russia's SVR, FSB, and GRU

In this episode, Tabetha Baume explains how Russia’s intelligence services target cleared U.S. personnel and defense contractors through espionage, cyber attacks, insider recruitment, and AI-driven information operations.

She highlights cases like Robert Hanssen, the Russian illegals network, and Peter Debbins to show how Russian intelligence patiently cultivates insiders and exploits digital platforms, ransomware, and online communities to gather intelligence.

Her key message is that cleared organizations must strengthen cybersecurity, insider threat awareness, and reporting processes to defend against increasingly sophisticated Russian intelligence operations.

Episode 39 Summary – CFD Podcast: The World's Most Active Espionage Machine

In this episode, Tabetha Baume explains how Chinese intelligence agencies actively target the U.S. defense industrial base through cyber operations, LinkedIn recruitment, university partnerships, and insider threats.

She highlights real-world espionage cases like Chi Mak and Kevin Mallory to show how cleared professionals can be exploited through long-term intelligence operations and coercion tactics.

Her key message is that cleared organizations must strengthen counterintelligence awareness, insider threat programs, and reporting processes to better protect personnel, programs, and classified information from ongoing Chinese intelligence collection efforts.

Episode 38 Summary – CFD Podcast: An Effective Security Team

In this episode, Tabetha Baume explains how to build an effective security team for cleared organizations, emphasizing key roles like the Facility Security Officer (FSO), Senior Management Official (SMO), and Insider Threat Program Senior Official (ITPSO), along with the need to meet regulatory requirements such as NISPOM.

She highlights essential skills, certifications, and team structures, noting the importance of communication, technical expertise, and choosing between centralized, decentralized, or hybrid models.

Her key message is that strong security teams go beyond compliance by investing in the right people, structure, and training to protect classified information while supporting business success.

Episode 37 Summary – CFD Podcast: OPSEC in the Digital Age

In this episode, Tabetha Baume explains how the digital age has transformed operational security, shifting the focus to managing the vast amount of data we unknowingly share.

She highlights key risks such as metadata, data aggregation, cloud storage, mobile devices, and IoT systems, showing how these can reveal sensitive patterns even without direct communication.

Her key message is that while technology increases exposure, strong OPSEC comes down to awareness, disciplined habits, and actively managing your digital footprint.

Episode 36 Summary – CFD Podcast: Foreign Financial Interests

In this episode, Tabetha Baume explains how foreign financial interests, such as bank accounts, investments, or property abroad, can create potential security risks if not properly managed.

She emphasizes the importance of reporting these interests during applications, reinvestigations, and when new assets are acquired, noting that transparency and compliance are critical. Her key message is that while foreign financial interests are not disqualifying, they must be fully disclosed and responsibly managed to maintain clearance eligibility.

Episode 35 Summary – CFD Podcast: AI in Federal Contracting

In this episode, Tabetha Baume warns about the reckless use of AI meeting assistants and transcription tools in federal contracting, explaining how these platforms can expose sensitive operational data to third-party systems. 

She highlights that even unclassified information, when aggregated, can create serious OPSEC risks, including exposure of facilities, personnel, and supply chains. She also notes potential violations of regulations like DFARS, NIST 800-171, CMMC, and SCIF security requirements. 

Her key message is that while AI is powerful, it must be used securely. Organizations need to audit their tools, enforce strict policies, and prioritize national security over convenience.

Episode 34 Summary – CFD Podcast: Navigating Security Violations

In this episode, Tabetha Baume explains what security violations are, how they occur, and the proper steps to respond when they happen. She defines a security violation as any failure to follow security procedures that could result in the compromise of classified information, covering examples across physical, information, personnel, and cybersecurity domains.

She emphasizes that immediate action is critical, including stopping the activity, securing any exposed information, notifying the Facility Security Officer (FSO), preserving evidence, and documenting the incident. The episode outlines how violations are assessed, investigated, and categorized as minor or major, with responses ranging from additional training to formal investigations, disciplinary action, or even criminal consequences depending on severity and intent.

Her key message is that while security violations can be serious, they are often preventable and should be treated as learning opportunities. Prompt reporting, honesty, cooperation, and a strong security culture are essential to protecting classified information and maintaining trust within cleared environments.